Two Actively Exploited PHP Flaws Put Crypto Platforms on Alert

SlowMist warned crypto exchanges, decentralized finance (DeFi) platforms and wallet providers to patch two PHP vulnerabilities that attackers are actively exploiting. The flaws can let intruders run code on vulnerable servers without logging in.

The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each carry a 9.2 score under CVSS v4.0 and are classified as critical. The no-login condition means an attacker does not need an account on an affected system before attempting an exploit. Code execution means the vulnerable server can be made to run code.

PHP released fixes on Oct. 21, including version 8.5.12. Operators can check which PHP versions their services run and apply the relevant update to affected systems.

The alert covers three types of crypto businesses: exchanges, DeFi platforms and wallet providers. Their shared concern is vulnerable PHP servers, where the flaws permit code execution.